The configuration of features under McAfee Application Control Options policies Enforce feature control must be documented in the organizations written policy.

From McAfee Application Control 7.x Security Technical Implementation Guide

Associated with: CCI-001774

SV-88877r1_rule The configuration of features under McAfee Application Control Options policies Enforce feature control must be documented in the organizations written policy.

Vulnerability discussion

By default, the McAfee Application Control prevents installation of ActiveX controls on endpoints, enforces memory protection techniques on endpoints, and prevents MSI-installers from running on endpoints. The Feature Control allows for those safeguards to be bypassed and in doing so renders the McAfee Application Control less effective.

Check content

Consult with the ISSO/ISSM to obtain a copy of the organization's documented policy for application whitelisting. Review the written policy for how the Solidcore client interface is used by the organization. Verify the written policy identifies whether additional features are enabled or not under "Enforce feature control" of the McAfee Application Control Options ePO policy. If the written policy does not identify whether additional features are enabled or not under "Enforce feature control" of the McAfee Application Control Options ePO policy, this is a finding.

Fix text

Follow the formal change and acceptance process to document any features needing to be enabled.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.